Messaging and Calls

Encryption protects the words. It does nothing about the record that a conversation happened, the phone number that ties you to everything else, or the person on the other end who decides to screenshot you. Most real damage happens there.

The threat: who can see your messages and calls

Your carrier, and anyone who gets into it

An ordinary text message travels through your wireless carrier's network in a form the carrier can read. So can anyone who breaks into that network or gets a lawful order for it. Your phone's texting app may carry several kinds of message, and they are not equal:

Carrier networks are a target for foreign intelligence services, too. In a joint statement, the FBI and CISA said hackers tied to the government of China broke into multiple US telecommunications companies, stole customer call records, got into the private communications of a limited number of people mostly involved in government or politics, and copied information connected to US law enforcement requests. Most readers are not on that target list, but anything unencrypted in a phone company's systems can end up somewhere you never expected.

SIM swaps: someone takes your phone number

Your phone number is a weak key that opens a lot of doors. Banks, email providers and social media send password-reset codes to it by text. In a SIM swap, a criminal gets your carrier to move your number onto a SIM card they hold. The FBI's 2022 SIM swap warning says criminals do it by impersonating you to a customer service rep, by paying off a carrier employee, or by planting malware on carrier systems through phishing. Once the number moves, your phone goes quiet and theirs gets your calls and reset codes. Then they reset your email and bank passwords. It happened to the SEC: on January 9, 2024, an intruder took over the agency's X account through a SIM swap on the phone number tied to it and posted a fake announcement that spot bitcoin funds had been approved.

The FBI's Internet Crime Complaint Center counted 320 SIM swap complaints from January 2018 through December 2020, with about $12 million in losses. In 2021 alone it got 1,611 complaints and more than $68 million in losses. People who post about cryptocurrency holdings are favorite targets.

The FCC adopted rules on November 15, 2023 requiring wireless carriers to use secure methods to authenticate customers before moving a number to a new SIM or a new carrier, with a compliance date no earlier than July 8, 2024. The rules help, though a bribed insider can still get around them.

Metadata: the outside of the envelope

EFF's guide Why Metadata Matters describes metadata as everything about a communication except the content. Who you called, at what time, for how long, from where. EFF's example is a call to a suicide prevention line placed from a bridge. Nobody needs the words.

Here is how a pile of call records becomes a map. Each record links two phone numbers. Put a few months of them together and you can see who calls whom, which numbers cluster together, who calls the organizer right before the meeting, who calls a clinic. Add the cell site that handled each call, and you get a rough path of where a phone went. In Carpenter v. United States (2018), the Supreme Court looked at 127 days of one man's cell-site records, 12,898 location points, about 101 a day, and held that the government's collection of those records was a Fourth Amendment search that generally needs a warrant.

Metadata also leaks in bulk. On July 12, 2024, AT&T told the SEC in a Form 8-K filing that someone had copied records covering calls and texts of nearly all of its wireless customers between about May 1 and October 31, 2022, plus January 2, 2023. The files held the phone numbers customers interacted with, counts of those interactions and call durations, and for a subset of records, cell site identification numbers. AT&T said the files had no content and no names, then noted that names can often be found from phone numbers using public online tools. That is the metadata problem, in the phone company's own words.

Signal is built to keep very little. When it answered a 2016 federal grand jury subpoena, the only data it could hand over was the date an account registered and the last date it connected.

Carriers that sold where your phone was

Your phone checks in with nearby cell towers all day, so your carrier always knows roughly where it is. For years the big carriers sold access to that location data. On April 29, 2024, the FCC fined T-Mobile more than $80 million, AT&T more than $57 million, Verizon almost $47 million and Sprint more than $12 million, nearly $200 million in all. The FCC said the carriers sold access to middlemen called aggregators, who resold it to other companies, and that the carriers pushed their duty to get your consent onto those buyers. In many cases nobody got it. The New York Times reported in May 2018 that a Missouri sheriff had used a location-finding service run by Securus, a company that provides phone service to jails and prisons, to track people. The FCC said the carriers kept their programs running without reasonable safeguards even after that came out. The fines finalized proposals the FCC first made in February 2020.

Backups: the copy you forgot about

An encrypted chat can still end up readable in the cloud. Under Apple's standard protection, Messages in iCloud is end-to-end encrypted only when iCloud Backup is off; with backup on, the backup holds a copy of the key. On Android, Google says received encrypted messages are included in your Android backup and can be read by any app you have given SMS or notification access. Either way, the strong lock on the conversation has a spare key somewhere else.

The person on the other end

Every member of a chat holds a readable copy on a phone with its own lock screen, backups and owner. Encryption does nothing about a member who screenshots, forwards, or hands the phone to someone else. In organizing groups and family fights alike, the screenshot is the most common leak. Removing a person from a group does not remove what they already saw.

The other version of this risk sits in your own home. Someone who has had your phone in hand can link a desktop app to your Signal or WhatsApp account and read along from another room. A linked device is a live copy of your chats. Strangers try it too: in February 2025, Google's threat intelligence group reported that Russia-aligned hackers sent Signal users booby-trapped QR codes that linked their accounts to the attackers' devices.

Who is most at risk

People leaving an abusive partner, who may know the phone passcode and the carrier PIN. People with crypto or a visible business, whom SIM swappers hunt. Organizers, reporters and sources, whose call patterns show who they talk to. And officials and campaign staff, the people the FBI and CISA warning was written for.

How to reduce it

Level 1 Everyday

Encrypted RCS between iPhone and Android answers the carrier problem for ordinary texts: once the lock shows, your carrier and anyone inside its network can no longer read the words. It does nothing about metadata, and it falls back to plain SMS if either side lacks support. Most large US carriers are on Apple's supported list as of October 2026.

Signal goes further. Every message and call is encrypted, and the service keeps almost no metadata. Hiding your number inside Signal keeps people you meet in a group chat from looking you up on a people-search site. The cost is that people who only have your number cannot find you in Signal, so you give them a username instead (Level 3).

Level 2 Careful

Level 2 is about your phone number and the phone in your hand. Registration Lock answers the SIM swap threat inside Signal: even if a criminal gets your number, they cannot register your Signal account on their device without your Signal PIN. If you forget the PIN with the lock on, you can be locked out for up to seven days. It does nothing for your bank or email, which is why you should move those accounts off text-message codes and onto an authenticator app or security key. The FBI recommends exactly that, and Two-factor and SIM swaps walks through it. Ask your carrier what account PIN or port-out protection it offers, and set it. Never give that PIN to someone who calls you; the FBI says to hang up and call the carrier's own number.

Disappearing messages answer a lost or stolen phone, and the snoop who picks it up while it is open. They do not answer a recipient who wants to keep a copy. Signal says plainly the feature is not for a contact who is your adversary, because anyone can photograph a screen. The cost is lost history, which stings the first time you hunt for an address someone sent. Notification settings answer the person standing next to your phone on the kitchen counter.

Level 3 Private

At Level 3 you stop handing out your phone number, which links your Signal account to your carrier, your bank and every people-search site in the next lesson. A Signal username links to nothing. Change it whenever it has spread further than you like; Signal says your existing chats are not notified, and the old username, QR code and link stop working.

Apple's Advanced Data Protection closes the backup gap by making iCloud Backup, and the Messages key inside it, end-to-end encrypted. That protects your messages, photos and backups if Apple's servers are breached or served with a demand for your account. On Android, go through your phone's special app access settings and remove notification access from apps that have no reason for it.

Level 4 Hardened

This level is for people with a specific person or group trying to watch them: a stalking survivor, a reporter with a nervous source. Here the person on the other end is the risk you plan around, and the tools are habits more than settings.

Keep sensitive groups small, read the member list before you post, and start a new group when a member leaves on bad terms. Verifying safety numbers answers someone sitting in the middle of your encrypted chat. When Signal warns that a safety number changed, ask the person through another channel whether they got a new phone; frequent, unexplained changes are a warning sign. Checking linked devices answers the partner who set up a desktop copy of your account. None of this stops a trusted member from deciding to leak.

If you talk to sources, read Secure communication with sources before you need it. If you work in government or politics, read CISA's mobile communications best practices, written after the telecom intrusions above.

Level 5 Hyper-vigilant

At this level you separate the phone from the person. Keep a second phone for Signal only, with a username, a handful of contacts and none of your personal accounts. It answers the risk that one compromised phone or account exposes your whole life. It costs a second device and constant discipline, and Hyper-vigilance covers why one stray login undoes it. Then assume the person you trust least in the group will read every message someday. For what matters most, talk in person, away from phones.

The ladder for this topic